A site called UK Visa Portal is supposed to help people apply for UK travel forms. Right now, it's also leaking their passports and selfies.
At least 100,000 files are sitting open online. And the company hasn't fixed it.
TechCrunch reported the leak Tuesday. A tipster flagged the site to the team.
The site collects passports and selfies from users paying for help with UK visa filings. Those files are sitting open on the web.
TechCrunch checked the data by reaching out to people whose info was leaked. The team held back specifics to avoid making the problem worse.
UK Visa Portal is not tied to the UK government. Some users complained they paid this firm by mistake.
They thought it was the official GOV.UK site. That mix-up is part of how third-party sites make money.
Search results for "UK visa" often show paid sites that look official. Most users don't read the fine print.
We break down stories like this and what they mean for investors every weekday in Market Briefs - and you get a free 45-minute investing masterclass when you sign up.
TechCrunch tried to reach the firm through the email on its site. Instead of management, replies came from purported lawyers and a PR firm.
As of publication, the leak is still open. UK Visa Portal doesn't list management names on its site.
It also doesn't list a security contact. So there's no clear way for tipsters to report a breach.
The pattern matters because these files are some of the most useful data for fraud. A passport plus a matching selfie can pass most know-your-customer checks.
Know-your-customer checks are how banks and exchanges verify a new user. Those checks tie an account to a real person.
Bad actors can use stolen files to set up online loans or crypto wallets in your name.
The UK travel form is filed direct through GOV.UK. Third-party sites add no real value unless you're hiring a lawyer.
For investors, the bigger story is that cybersecurity keeps showing up wherever weak third-party sites touch a real government form.
If you used UK Visa Portal, your files may already be leaked.
What can you do now? Freeze your credit at the three big bureaus.
Watch your bank and brokerage accounts for new sign-ups. Set up two-factor on all your logins.
None of that fully fixes the leak, but it cuts the risk of fraud.
The UK government has warned travelers about fake-looking visa sites in the past. Many third-party sites still appear in search results next to the real one.
That's a market gap that has been slow to close. A steady flow of new users keeps the bad sites alive.
The lesson for travelers: type the GOV.UK address yourself instead of clicking the first link.
Sign up for Market Briefs for daily reads on the moves that matter to your money - a 45-minute investing course is thrown in as a bonus when you join.
